5.6 Data Protection and Data Integrity

Protecting data at rest, in transit, in use

Data at rest (stored data) is protected with encryption and access controls. Data in transit (moving across networks) is protected with protocols like TLS. Data in use (actively processed) needs safeguards against unauthorized memory access. Encrypting data turns readable plaintext into unreadable ciphertext, so even if intercepted or stolen, it can't be understood without the decryption key.

Ensuring data integrity

Data integrity means data hasn't been altered or corrupted, whether accidentally or maliciously. Hashing creates a fixed-length digital fingerprint (hash value) of data; if the data changes even slightly, the hash changes completely. Comparing hash values before and after transmission or storage verifies the data wasn't tampered with, without revealing the actual data content.

Backups and recovery

Backups are copies of data stored separately so information can be restored after loss, corruption, or a ransomware attack. Good backup practice includes regular scheduling, storing copies offsite or in the cloud, and testing restoration. The 3-2-1 rule (3 copies, 2 different media types, 1 offsite) is a common strategy to ensure data availability and integrity.

Key terms

Data integrity

Assurance that data has not been altered or corrupted improperly.

Hashing

Creates a fixed-length fingerprint of data used to verify it hasn't changed.

Data at rest / in transit / in use

The three states of data: stored, moving across a network, and actively being processed.

3-2-1 backup rule

Keep 3 copies of data, on 2 different media types, with 1 copy stored offsite.

Ciphertext

The unreadable result of encrypting plaintext data.

Try an AP-style question

What should you conclude?

1. The file is safe to install
2. Hashes always differ slightly
3. The file was altered or corrupted
4. The website is faster now